https://live.paloaltonetworks.com/t5/prisma-access-discussions/bidirectional-user-id-redistribution-between-prisma-access-and/m-p/639052#M1017 <P>Why do you have issues with this ? As shown in the documentation you can select a master device&nbsp;<A href="https://docs.paloaltonetworks.com/prisma/prisma-access/3-2/prisma-access-panorama-admin/configure-user-based-policies-with-prisma-access/retrieve-user-id-information/retrieve-group-mappings-using-a-master-device" target="_blank">https://docs.paloaltonetworks.com/prisma/prisma-access/3-2/prisma-access-panorama-admin/configure-user-based-policies-with-prisma-access/retrieve-user-id-information/retrieve-group-mappings-using-a-master-device</A>&nbsp;that can feed this data to Prisma Access. Also if you use the Cloud Identity Engine (CIE) as authentication source for the on-prem firewalls it will feed the prisma access&nbsp;<A href="https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/get-started-with-the-cloud-identity-engine/set-up-the-cloud-identity-engine" target="_blank">https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/get-started-with-the-cloud-identity-engine/set-up-the-cloud-identity-engine&nbsp;</A></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>Also if your Service Connection DC is the one that needs to send the data see :</P> <P>&nbsp;</P> <P><A href="https://live.paloaltonetworks.com/t5/prisma-access-discussions/prisma-access-mobile-users-user-id-data-redistribution-to-on/td-p/605681" target="_blank">https://live.paloaltonetworks.com/t5/prisma-access-discussions/prisma-access-mobile-users-user-id-data-redistribution-to-on/td-p/605681</A></P> <P>&nbsp;</P> Wed, 20 Nov 2024 08:48:06 GMT nikoolayy1 2024-11-20T08:48:06Z https://live.paloaltonetworks.com/t5/prisma-access-discussions/bidirectional-user-id-redistribution-between-prisma-access-and/m-p/617647#M1014 <P>Hello Everyone,</P> <P>&nbsp;</P> <P>My user-id redistribution topology is as follows:</P> <P>Prisma access --&gt; Azure VM 300 firewall --&gt; On-prem PA Firewalls (about 4 HA Pairs) and vice -versa as i need bidirectional ip-username mappings.</P> <P>&nbsp;</P> <P>Reason to do directional mappings is that We have GP users and branch users on prisma access for which i need user-id mapping and also, on local firewalls, we have internal gateways configured and local site users are hitting these internal gateways for which we need user-id mappings.&nbsp;</P> <P>&nbsp;</P> <P>I am able to get user id mappings for GP users from Prisma access but unable to get the mappings for the Remote network users and local firewalls users.</P> <P>&nbsp;</P> <P>Please suggest.&nbsp;</P> <P>&nbsp;</P> Thu, 14 Nov 2024 07:51:43 GMT https://live.paloaltonetworks.com/t5/prisma-access-discussions/bidirectional-user-id-redistribution-between-prisma-access-and/m-p/617647#M1014 Richa_Sharma 2024-11-14T07:51:43Z https://live.paloaltonetworks.com/t5/prisma-access-discussions/bidirectional-user-id-redistribution-between-prisma-access-and/m-p/639052#M1017 <P>Why do you have issues with this ? As shown in the documentation you can select a master device&nbsp;<A href="https://docs.paloaltonetworks.com/prisma/prisma-access/3-2/prisma-access-panorama-admin/configure-user-based-policies-with-prisma-access/retrieve-user-id-information/retrieve-group-mappings-using-a-master-device" target="_blank">https://docs.paloaltonetworks.com/prisma/prisma-access/3-2/prisma-access-panorama-admin/configure-user-based-policies-with-prisma-access/retrieve-user-id-information/retrieve-group-mappings-using-a-master-device</A>&nbsp;that can feed this data to Prisma Access. Also if you use the Cloud Identity Engine (CIE) as authentication source for the on-prem firewalls it will feed the prisma access&nbsp;<A href="https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/get-started-with-the-cloud-identity-engine/set-up-the-cloud-identity-engine" target="_blank">https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/get-started-with-the-cloud-identity-engine/set-up-the-cloud-identity-engine&nbsp;</A></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>Also if your Service Connection DC is the one that needs to send the data see :</P> <P>&nbsp;</P> <P><A href="https://live.paloaltonetworks.com/t5/prisma-access-discussions/prisma-access-mobile-users-user-id-data-redistribution-to-on/td-p/605681" target="_blank">https://live.paloaltonetworks.com/t5/prisma-access-discussions/prisma-access-mobile-users-user-id-data-redistribution-to-on/td-p/605681</A></P> <P>&nbsp;</P> Wed, 20 Nov 2024 08:48:06 GMT https://live.paloaltonetworks.com/t5/prisma-access-discussions/bidirectional-user-id-redistribution-between-prisma-access-and/m-p/639052#M1017 nikoolayy1 2024-11-20T08:48:06Z